Re: SSH probe attack afoot?

[Jeffrey Goldberg <jeffrey () goldmark org>]

On Feb 6, 2005, at 7:09 AM, Bernie Cosell wrote:

> We're now getting hammered with the third round of ssh probes in the 
> last
> four days [one from CA, one from Brazil and one from Virginia].  I was
> wondering: is there some virus or the like floating around now that
> leaves an ssh-hammering zombie in its wake?  Or is it just coincidental
> that we have gotten three floods?

I fear that some hosts I'm responsible for are (they almost certainly 
were) such zombies.  chkrootkit didn't turn up anything.  Is there 
something (in addition to anomolous ssh traffic) that I should be 
looking for.

But they don't seem to hammer much.  They seem to do their stuff in 
infrequent bursts, so I don't know which machines I've cleaned, which 
are reinfected and which have been compromised and have gone unnoticed. 
 Advice on eradication would be welcome.

You'll be glad to know that I've been trying to carefully monitor 
outgoing ssh traffic so as not to a (further) nuisance to the rest of 
the net.

With apologies,

-j

--
Jeffrey Goldberg                        http://www.goldmark.org/jeff/